Open5GS versions 1.3.0 through 2.8.0 have a heap out-of-bounds write in the multipart parser that can be triggered by an unauthenticated attacker sending an empty multipart boundary to the SBI interface. The overflow corrupts memory, which may cause the affected network function to crash or behave unpredictably. No elevation of privilege is explicitly documented, but the corruption could be exploited to cause a denial of service or, in a worst‑case scenario, arbitrary code execution if the memory write reaches executable code.

The vulnerability affects the Open5GS software package managed by the open5gs organization. All releases from 1.3.0 up to and including 2.8.0 are impacted. The affected component is the SBI multipart parser within the open5gs library. Specific subcomponents included in the cpe list are the lib/sbi/contrib/multipart_parser.c and associated message handling files.

The CVSS score of 8.7 indicates a high severity, and the EPSS data is not available, so precise exploitation likelihood is uncertain. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited in the public domain. The likely attack vector is through the network exposed SBI endpoint, and because it is unauthenticated, any external host that can reach the SBI interface could trigger the exploit. The exploit requires crafting a multipart/related request with an empty boundary and can be performed without special privileges.